[ISN] BUSTED! Secret app on millions of phones logs key taps

[InfoSec News <alerts@xxxxxxxxxxxxxxx>]

http://www.theregister.co.uk/2011/11/30/smartphone_spying_app/

By Dan Goodin in San Francisco
The Register
30th November 2011

An Android app developer has published what he says is conclusive proof 
that millions of smartphones are secretly monitoring the key presses, 
geographic locations, and received messages of its users.

In a YouTube video posted on Monday, Trevor Eckhart showed how software 
from a Silicon Valley company known as Carrier IQ recorded in real time 
the keys he pressed into a stock EVO handset, which he had reset to 
factory settings just prior to the demonstration. Using a packet sniffer 
while his device was in airplane mode, he demonstrated how each numeric 
tap and every received text message is logged by the software.

Ironically, he says, the Carrier IQ software recorded the âhello worldâ 
dispatch even before it was displayed on his handset.

Eckhart then connected the device to a Wi-Fi network and pointed his 
browser at Google. Even though he denied the search giant's request that 
he share his physical location, the Carrier IQ software recorded it. The 
secret app then recorded the precise input of his search query -- again, 
âhello worldâ -- even though he typed it into a page that uses the SSL, 
or secure sockets layer, protocol to encrypt data sent between the 
device and the servers.

[...]

_____________________________________________________
Subscribe to InfoSec News - www.infosecnews.org
http://www.infosecnews.org/mailman/listinfo/isn